Enterprises (e.g., financial service providers, healthcare providers, critical infrastructure providers, etc.) store valuable data, and transfer it over networks. Information spreads across datacenters often through dedicated telco-provided networks. Overlay networks provide the same service across the wide area network (WAN) on a public network for enterprises, and are susceptible to threats such as snooping, man in the middle attack (MITM), and forging. As enterprises widely adopt cloud-based Software-Defined Data Center (SDDC) instead of dedicated datacenters, new challenges are introduced, and protecting the data flowing into, within, and out of the cloud becomes a necessity. The privacy guarantee of private datacenters is no longer assumed, and threats similar to those in the Internet prevail.
Cryptography protects data and communication channels from malicious parties, provides confidentiality to enterprise dataflow in the cloud, and provides control over the data to the enterprise. However, current approaches to encrypt network data fall short in terms of contextual information, isolation, granularity, or ease of management. For example, IPSec has been a key game changer in business to business (B2B), virtual private networks (VPNs), and branch-office networking. However, IPSec tunneling by the edge devices is oblivious to the application context and the user generating the network traffic, lacks granularity as it encrypts data in bulk, and cannot address various internal threats as the traffic between the virtual machines (VMs) and the edge devices is in plaintext. Moreover, the known problem with traditional IPSec is that both endpoints negotiate a security association, and agree upon a key. In a network that includes N endpoints, the number of keys in the secure overlay is O(N2).
In-VM encryption provides contextual information for fine-grained security decisions. However, in-guest encryption fails to isolate the protected data from the protection mechanism as they both reside in the guest. This scheme also suffers from inability for upgrades, and is extremely difficult to manage from a centralized management console.